redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

staging/lustre/llite: check for integer overflow in hsm user request 

Check to make sure total size of request does not overflow when
calculated.  Return -1 from hur_len() if it does overflow.

Signed-off-by: Nathaniel Clark <nathaniel.l.clark@intel.com>
Reviewed-on: http://review.whamcloud.com/10615
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4984
Reviewed-by: Andreas Dilger <andreas.dilger@intel.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hifive-unleashed-5.1
Nathaniel Clark 2014-08-15 12:48:06 -04:00 committed by Greg Kroah-Hartman
parent d41b7b74cf
commit 6b2eb32e69
2 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/staging/lustre/lustre/include/lustre/lustre_user.h
View File

@ -997,12 +997,25 @@ static inline void *hur_data(struct hsm_user_request *hur)
return &(hur->hur_user_item[hur->hur_request.hr_itemcount]);
}
/** Compute the current length of the provided hsm_user_request. */
static inline int hur_len(struct hsm_user_request *hur)
/**
* Compute the current length of the provided hsm_user_request. This returns -1
* instead of an errno because ssize_t is defined to be only [ -1, SSIZE_MAX ]
*
* return -1 on bounds check error.
*/
static inline ssize_t hur_len(struct hsm_user_request *hur)
{
return offsetof(struct hsm_user_request,
hur_user_item[hur->hur_request.hr_itemcount]) +
hur->hur_request.hr_data_len;
__u64 size;
/* can't overflow a __u64 since hr_itemcount is only __u32 */
size = offsetof(struct hsm_user_request, hur_user_item[0]) +
(__u64)hur->hur_request.hr_itemcount *
sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len;
if (size != (ssize_t)size)
return -1;
return size;
}
/****** HSM RPCs to copytool *****/

4
drivers/staging/lustre/lustre/llite/dir.c
View File

@ -1787,7 +1787,7 @@ out_quotactl:
return ll_fid2path(inode, (void *)arg);
case LL_IOC_HSM_REQUEST: {
struct hsm_user_request *hur;
int totalsize;
ssize_t totalsize;
OBD_ALLOC_PTR(hur);
if (hur == NULL)
@ -1802,6 +1802,8 @@ out_quotactl:
/* Compute the whole struct size */
totalsize = hur_len(hur);
OBD_FREE_PTR(hur);
if (totalsize < 0)
return -E2BIG;
/* Final size will be more than double totalsize */
if (totalsize >= MDS_MAXREQSIZE / 3)